The rapid growth of the Industrial Internet of Things (IIoT) has introduced complex security challenges requiring accurate, scalable, and privacy-preserving intrusion detection solutions. This paper presents a hybrid framework that combines Hunting Gradient Snake–Cuckoo Search (HGS–CS) feature optimization with a Transformer–LSTM detection model enhanced by a gated fusion mechanism under a federated learning setup. The proposed system comprises three main components: (1) a dual-phase HGS–CS optimizer that selects the most informative features by balancing global exploration and local refinement; (2) a gated Transformer–LSTM architecture that effectively captures both temporal dependencies and spatial correlations in IIoT traffic; and (3) an attention-weighted SwarmFed aggregation protocol that enables decentralized yet coordinated model training across multiple clients while preserving data privacy. Experimental evaluations on four benchmark IIoT datasets, CICAPT-IIoT, Edge-IIoTset, WUSTL-IIoT, and ToN-IoT, show that the proposed model achieves an average accuracy of 99.27%, precision of 99.25%, recall of 99.17%, F1-score of 99.21%, and AUC of 99.35%, surpassing recent state-of-the-art methods by 0.8–1.3% across all metrics. The model also exhibits low standard deviation (\(\le \)0.22%) across independent runs, confirming its robustness and stability. Overall, this study introduces a numerically validated, hybrid optimization and deep learning framework that delivers reliable, scalable, and privacy-aware intrusion detection for next-generation IIoT environments.

The increasing interconnection of industrial devices, programmable logic controllers, edge platforms, and networked control systems has expanded the attack surface of Industrial Internet of Things (IIoT) environments. Machine-learning-based intrusion detection can improve the identification of malicious activities, but centralized training requires the collection of distributed industrial data and may provide an unrealistic estimate of detector performance when evaluation relies on randomly partitioned traffic. Federated learning offers a data-local alternative; however, its effectiveness can be affected by non-independent and identically distributed (non-IID) client data and temporal changes in attack and network behavior. This study presents FedIDS-IIoT, a federated intrusion detection framework evaluated using the CICAPT-IIoT dataset, with particular emphasis on non-IID attack distributions and temporal distribution shift. Sample-size-weighted federated averaging (FedAvg) is evaluated across controlled client configurations in which attack observations are progressively concentrated among five simulated clients. A training-only feature-selection procedure is used to derive a compact 20-feature representation, while model selection and operating-threshold determination are completed before evaluation on a chronologically later and previously untouched traffic block. The federated detector is evaluated against a centralized XGBoost reference and two matched federated optimizers, FedProx and FedAdam, under the same development protocol and feature representation. In the matched federated comparison, FedAvg achieves the highest F1-score in the mild and moderate development partitions, whereas FedProx is marginally higher in the severe partition (0.9643 vs. 0.9633). This result is interpreted as an optimizer-dependent operating trade-off rather than evidence of universal FedAvg superiority. Under the frozen operating threshold, FedAvg also produces substantially fewer false positives on the temporal test set. The non-IID experiments indicate that moderate differences in attack distribution have limited impact, whereas severe concentration of attack evidence can reduce detection performance. A paired McNemar test confirms that the difference in temporal error behavior between the two detectors is statistically significant, and a cost analysis shows that the federated detector needs only a few thousand parameters and a few megabytes of communication over the entire training run. The MADQN component is treated as a secondary exploratory simulation and is not presented as real-life network-response validation. These findings demonstrate the importance of evaluating federated IIoT intrusion detection under both client-level distribution heterogeneity and temporal distribution shift rather than relying solely on conventional random train–test evaluation.

Industrial Internet of Things (IIoT) systems are increasingly exposed to cyberattacks in which control commands remain protocol-compliant and statistically plausible while gradually driving physical processes toward unsafe operating conditions. Conventional intrusion detection approaches based on network signatures, reconstruction errors, or deviations from normal behaviour may therefore identify such attacks only after a noticeable process deviation has already occurred. We present PREVENT-IIoT, a consequence-aware intrusion detection framework designed to detect potentially harmful control actions before physical impact. The framework uses an action-conditioned probabilistic world model, trained on trusted normal operation, to estimate the future evolution of the physical process under the observed control action. A safety-reachability module then estimates the probability of leaving the safe operating envelope and the expected time to an unsafe state. To distinguish harmful manipulation from legitimate operational changes, a counterfactual risk mechanism compares the predicted risk of the observed action with the risk associated with a nominal supervisory action. These predictive signals are combined with dependency-graph consistency and network-telemetry indicators through a sequential fusion mechanism; the fusion weights are the only supervised element, and we also report a fully unsupervised variant that requires no attack labels. Experiments on a physics-based industrial process testbed covering nine attack families and ten random seeds show that PREVENT-IIoT achieves an AUPRC of 0.674, compared with 0.643 for the strongest classical baseline and 0.56 for the strongest of four deep baselines, namely, USAD, TranAD, LSTM-AE and MAD-GAN. Crucially, every reconstruction-, forecasting- and distance-based detector we evaluate, whether classical or deep, provides essentially no pre-impact warning and has a pre-impact rate near zero, whereas PREVENT-IIoT detects 53% of consequence-bearing attacks before physical impact. The safety model achieves a Brier score of 0.047, an expected calibration error of 0.056, and a mean absolute error of approximately 2 s for time-to-unsafe estimation. Leave-one-attack-out experiments show that the framework generalises to previously unseen attack families. We further add a long-memory CUSUM channel on the world-model residual that recovers the slow stealth-bias family, raising its recall from 0 to 0.84, which the windowed detector misses, at no cost to the false-alarm budget.